-- Google Drive agency OAuth + per-tenant folder links
-- Idempotent.

-- Agency-wide OAuth tokens (service role only; no client policies)
create table if not exists public.agency_oauth (
  provider text primary key,
  account_email text,
  access_token text not null,
  refresh_token text,
  expires_at timestamptz,
  scopes text,
  meta jsonb not null default '{}'::jsonb,
  updated_at timestamptz not null default now()
);

alter table public.agency_oauth enable row level security;

-- Widen integrations.provider check to include google_drive
alter table public.integrations drop constraint if exists integrations_provider_check;
alter table public.integrations
  add constraint integrations_provider_check
  check (provider in (
    'meta_ads',
    'google_ads',
    'ga4',
    'search_console',
    'tag_manager',
    'clientify',
    'klaviyo',
    'mailchimp',
    'google_drive'
  ));

-- Seed google_drive slots for every tenant
insert into public.integrations (tenant_id, provider, status, label)
select t.id, 'google_drive', 'disconnected', 'Google Drive'
from public.tenants t
on conflict (tenant_id, provider) do nothing;

-- Optional Drive file id on portal assets (mirror)
alter table public.asset_files
  add column if not exists drive_file_id text;